Every domain needs a password and account lockout policy for its user accounts. For domain accounts, that policy comes from Group Policy settings under Computer Configuration, Policies, Windows Settings, Security Settings, Account Policies, and it only takes effect when the GPO is linked at the domain level. By convention it lives in the Default Domain Policy. If you link a GPO with password settings to an OU, it affects only the local accounts on computers in that OU, not domain users. That is the classic limitation: one password policy per domain.
Keep reading for free
Create a free StudyToCert account to read the rest of this lesson: 6 more sections, 5 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.